CVE-2026-74374
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the Linux kernel, the md/raid1 and md/raid10 drivers have been fixed to detect the error path using md_cloned_bio() instead of relying on r1_bio or r10_bio->read_slot, which may be NULL or -1 after splitting and resubmitting a failed bio. The previous logic could lead to using GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), potentially causing a deadlock under memory pressure.
Risk Assessment
This may lead to system deadlocks under low memory conditions, especially in RAID arrays.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix for CVE-2026-74374.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with md_cloned_bio() Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure.